From a2df27d7f2ec82ad65abdcd724ba3388f5eef0d0 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Tue, 29 Jul 2014 12:58:31 -0600
Subject: [PATCH] fix(forgot-password): allow aliases (x+y@z.com) in email
 lookup, fixes #3805

---
 src/controllers/auth.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/controllers/auth.js b/src/controllers/auth.js
index ac5bac6696..8884128111 100644
--- a/src/controllers/auth.js
+++ b/src/controllers/auth.js
@@ -173,7 +173,9 @@ api.resetPassword = function(req, res, next){
     newPassword =  utils.makeSalt(), // use a salt as the new password too (they'll change it later)
     hashed_password = utils.encryptPassword(newPassword, salt);
 
-  User.findOne({'auth.local.email':new RegExp("^"+email+"$","i")}, function(err, user){
+  // escape email for regex, then search case-insensitive. See http://stackoverflow.com/a/3561711/362790
+  var emailRegExp = new RegExp('^' + email.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&') + '$', 'i');
+  User.findOne({'auth.local.email':emailRegExp}, function(err, user){
     if (err) return next(err);
     if (!user) return res.send(500, {err:"Couldn't find a user registered for email " + email});
     user.auth.local.salt = salt;